I have a Sitecore 8.1 Update-3 solution. We have some simple ASPX files that we are trying to use as part of a Facebook application. Apparently the Facebook application displays the pages in an iFrame. And apparently somehow our pages are getting the X-Frame-Options: SAMEORIGIN header added to the response. I cannot figure out where that is coming from. And because of that header these pages cannot be displayed in a Facebook iFrame.
Does anyone know why this is happening? Is this a Sitecore issue? Or is it something deep in IIS or the machine config or something? It is driving me crazy. I have been able to go in to IIS and add a second X-Frame-Options header with the value of "ALLOW_FROM https://facebook.com". But that doesn't solve the problem. That just creates 2 headers and it still won't display the page in an iFrame.
I can't figure out if this is a Sitecore problem or an IIS problem.